On 07/31/2014 11:28 AM, Daniel J Walsh wrote:
On 07/31/2014 01:52 PM, Paolo Galtieri wrote:
> On 07/31/2014 09:51 AM, Michael Cronenworth wrote:
>> On 07/31/2014 10:54 AM, pgaltieri . wrote:
>>> sudo semanage fcontext -a -t var_log_t 'logs'
>> [snip]
>>
>> You need to pass the full path here.
>>
>> # semanage fcontext -a -t var_log_t /media/NSM/NSM-SENSOR-2/logs
>>
> I tried that and the restorecon and the file type is still file_t
> instead of var_log_t.
>
> Paolo
# semanage fcontext -a -t var_log_t '/media/NSM/NSM-SENSOR-2/logs(/.*)?'
# restorecon -R -v /media/NSM/NSM-SENSOR-2
Should change labels.
What's interesting is if I do
semanage fcontext -a -t snort_log_t /media/NSM/NSM-SENSOR-2/logs
restorecon -v /media/NSM/NSM-SENSOR-2/logs
restorecon reset /media/NSM/NSM-SENSOR-2/logs context
unconfined_u:object_r:file_t:s0->unconfined_u:object_r:snort_log_t:s0
ll -Zd /media/NSM/NSM-SENSOR-2/logs
drwxr-xr-x. snort snort unconfined_u:object_r:snort_log_t:s0
/media/NSM/NSM-SENSOR-2/logs
so it worked in this case. Now if I do the same thing, but using
var_log_t as the FILE_TYPE it works.
Is it possible that the error about no default label is what is
preventing me from changing the context the first time I tried? Since I
didn't get the error when I changed the context to snort_log_t
restorecon changed it and now SELinux thinks there is a default label
(snort_log_t). Subsequent changes work because of the presence of a
default label.
Paolo